tizen/src/sdl_rotate.c: Fix buffer overrun error reported by efence

Destination pixel is calculated using four source pixels. When source
pixel is got from last line or row next rigth or bottom pixel could
be not existent since we reached the end of src->pixels.

Signed-off-by: Evgeny Voevodin <e.voevodin@samsung.com>

diff --git a/tizen/src/sdl_rotate.c b/tizen/src/sdl_rotate.c
index e268c97..8f07edc 100644 (file)
--- a/tizen/src/sdl_rotate.c
+++ b/tizen/src/sdl_rotate.c
@@ -638,7 +638,7 @@ void _transformSurfaceRGBA(SDL_Surface * src, SDL_Surface * dst, int cx, int cy,
                        for (x = 0; x < dst->w; x++) {
                                dx = (sdx >> 16);
                                dy = (sdy >> 16);
-                               if ((dx > -1) && (dy > -1) && (dx < src->w) && (dy < src->h)) {
+                               if ((dx > -1) && (dy > -1) && (dx < src->w - 1) && (dy < src->h - 1)) {
                                        if (flipx) dx = sw - dx;
                                        if (flipy) dy = sh - dy;
                                        sp = (tColorRGBA *) ((Uint8 *) src->pixels + src->pitch * dy);